ECHO Ground Truth: “Financing the Illicit: What ‘Shadow Economy’ Really Means” with John F. Tobon
GUEST BIO: For over thirty years, John F. Tobon chased the financial shadows of organized crime—from money laundering networks in Bogotá to international trade schemes in New York. As a former HSI Assistant Director, he understands how illicit economies really function—and how to disrupt them. Today, through Tobon Consulting, he helps banks and companies close the gaps criminal networks depend on.
Following his retirement from federal service, John founded Tobon Consulting in February 2025, where he now advises clients across both the public and private sectors. His work focuses on anti-money-laundering (AML) training and capacity building, as well as management consulting for companies developing or repositioning new products in emerging markets. Tobon also helps organizations assess evolving technological risks, identify systemic vulnerabilities, and craft strategies to strengthen their overall resilience.
For inquiries or consultation, John can be reached at John@JFTobonConsulting.com or through jftobonconsulting.com.
Executive Summary:
In this ECHO Ground Truth interview, Bishop sits down with former HSI Assistant Director John F. Tobon to unpack the mechanics of the global illicit economy—where shadow trade, foreign exchange markets, and weak regulatory oversight allow transnational criminal organizations (TCOs) to thrive. From over three decades of experience in federal law enforcement, Tobon posits that kinetic operations alone are incapable of dismantling cartels and TCOs; instead arguing that disrupting their financial systems while addressing both supply and demand are the only feasible ways to combat cartels and TCOs. Tobon also discusses how technology has reshaped money laundering and law enforcement collaboration, emphasizing the need for sustained public–private partnerships. His message is clear: regardless of how they’re designated, to defeat organized crime, we must follow—and choke—the money.
Ground Truth:
Q: Welcome John, it’s great to have you with us and I can’t imagine a better guest for our first of many Ground Truth interviews. To start, can you give us a brief overview of who you are, your career, and your transition and interests in post-fed life?
A: I was a Special Agent with the U.S. Customs Service and later—due to the transition—with Homeland Security Investigations (HSI). I was a federal employee for about 31 and a half years, and the vast majority of that time was spent as a Special Agent working in New York, Seattle, Miami, Honolulu, and Bogotá, Colombia, primarily targeting transnational criminal organizations.
I did a little bit of undercover work and a lot of investigations targeting the financial proceeds of criminal organizations—primarily drug trafficking organizations—but always with a focus on the money side of it. I also did a lot of policy work during my time in D.C., and eventually, at the time I retired, I was serving as Assistant Director over the Countering Transnational Organized Crime Division.
Upon retirement, I transitioned into the consulting world—helping companies and financial institutions evaluate their anti–money-laundering posture, build their capacity to identify vulnerabilities and threats, and develop strategies to minimize their impact on the organization.
“The ‘shadow economy’ isn’t always in the shadows… if 85% of international trade isn’t financed through regulated financial systems, where is that money coming from?”
SA Tobon arrests Jhonny Cano Correa, then the Chief Security for the Colombian Norte del Valle Cartel (NVC).
Q: With the recent designation of several cartels and transnational criminal organizations as Foreign Terrorist Organizations, there’s been renewed focus on the difference between kinetic actions and targeting illicit finances. For both public- and private-sector partners, it’s critical to understand that dismantling these groups isn’t just about physical operations—it’s about disrupting the money that keeps them alive. When we talk about money laundering, the term shadow economy often comes up. In your words, what defines that shadow economy today?
A: What really defines it is that it still works on the basic principle of supply and demand. All of these criminal organizations—especially cartels—are essentially trading in their commodities, like drugs, and receiving another commodity in return: cash, or the value of those illicit goods in U.S. dollars.
The “shadow economy” isn’t always in the shadows. When you look at international trade, and the percentage of trade financed by formal financial institutions or banks around the world, about 85% of it isn’t financed by those institutions. So that begs the question: if 85% of international trade isn’t financed through regulated financial systems, where is that money coming from? Where is that financing sourced?
That’s where organized crime meets international trade. For every shadow, you need a sun—the sun is the demand for that financing, and the shadow comes from those who don’t ask where the money is coming from.
Q: When people talk about Department of Homeland Security (DHS) HSI, I think a lot of people automatically gravitate towards associating HSI as an agency strictly with border enforcement and Customs. However, as you mentioned, HSI deals with that global financial flow, those complex supply chains, both licit and illicit. How did you see the mission of HSI kind of evolving throughout your career?
A: It went through a huge change. I came on board in 1997 as a U.S. Customs Service Special Agent, and the Customs Service was an incredible agency in terms of authority. Our funding and resources never lacked for anything, and we had a long history.
There’s always been this back-and-forth about which agency was the first law enforcement body in the U.S. Well, it was actually the U.S. Customs Service, created on July 4, 1789. With that agency came Customs Inspectors and, later, Customs Special Agents. That long history was something we took a lot of pride in.
Because of our position on the border, it was actually U.S. Customs that enforced the very first anti–money-laundering laws. The Financial Crimes Enforcement Network—FinCEN—which is now the financial intelligence unit within the Department of the Treasury, actually started as a division of U.S. Customs. So there was a lot to be proud of and a lot of deep institutional ties.
Then, suddenly, 9/11 happened. This new agency—the Department of Homeland Security—was created. We weren’t really sure how that was going to impact us or what was going to happen. Then Immigration and Customs Enforcement (ICE) was formed, and we thought, “Okay, so what happens now? How will this really affect our mission?”
Before 9/11, everyone knew the mission: interdiction and follow-on investigations from those interdictions. We were also proactively working to infiltrate organizations and use that intelligence to feed our interdiction mission. After 9/11, when DHS was created, it was announced with a lot of hype but not much information. There were very few details—especially for those of us who were going to become part of this new department—about what the mission would actually be.
Our New York headquarters was located in the World Trade Center complex, and we lost that office on 9/11. We were at Six World Trade, next to Tower One. So, for us, the shift became personal. We wanted to be part of the terrorism mission.
We pivoted toward investigating terrorism financing—using the same skills and tools we had developed for identifying criminal networks and drug traffickers—and applying them to find terrorists. It was personal; they had destroyed our office. For those of us who were there that day, myself included, it felt like they had literally taken our house.
That’s when we created Operation GREENQUEST, which was the first major shift I saw as an agent. Suddenly, our focus was terrorism finance. But because no one had clearly defined responsibilities, we started bumping up against other agencies’ lanes—especially the FBI’s.
There were interagency fights. People said, “You’re in our lane.” And we said, “But you didn’t even know these people existed—we just found them, and now we have the investigation.” The response was, “Doesn’t matter. They’re terrorists, so they belong to us.” That was the first real dose of reality—that politics and bureaucracy were going to define this new department.
We had to find ways to contribute our skills to the overall mission while avoiding the internal politics. Then, immediately after the merger between U.S. Customs and Immigration and Naturalization, two new agencies were created: Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP).
One of the first things that happened after that announcement was that the DEA administrator at the time sent a telegram to all field offices saying, “U.S. Customs is no longer involved in countering drugs—only we can prevent forest fires.” And we thought, what are you talking about? On one side, we were being told we were stepping into the FBI’s lane, and on the other, the DEA was trying to take our mission. We were left wondering, what’s going on here?
Those were some very rough years. We also began to feel the negative connotations of civil immigration enforcement, which took a toll. We had to merge two very different cultures: highly motivated, type-A Customs agents and Special Agents from the former Immigration and Naturalization Service (INS), whose structure, selection process, and investigative focus were different.
INS investigations were generally less appealing to prosecutors, while Customs agents had strong relationships with U.S. Attorney’s Offices and handled high-profile, complex cases. Prosecutors knew Customs cases would be well-resourced and worth their time. The INS side didn’t have that same perception, so merging those two worlds was difficult.
It probably took 10 to 12 years before people stopped introducing themselves as “legacy Customs.” For a long time, we still said, “Listen, we’re from this side of the house.” That was the biggest cultural shift.
Fast-forward to today, and a lot of our worst fears have been realized. The investigative side has become increasingly nebulous, and so much of the focus now is on civil immigration enforcement.
Q: Over the past 10 years, you know, with your investigations into illicit supply chains and money laundering; what did you see that changed the most? Was the technology? Globalization? The adversaries themselves?
A: I would say there were a couple of really positive changes. First, the relationship with the financial industry improved by leaps and bounds over the years. We’ve reached a point where both sides can speak honestly without anyone taking it personally. It’s become a genuinely productive partnership—law enforcement is learning from the industry, and the industry is learning from law enforcement.
Now, that doesn’t mean financial institutions are no longer being exploited, or that every available resource is being used to detect money laundering. That’s not the case. But there’s definitely more awareness today than there’s ever been.
Second, probably the biggest game changer for law enforcement has been the ease with which we can now communicate with partners—whether they’re across the country or across the world. Believe it or not, that used to be one of our biggest challenges. These investigations always had links that stretched nationally or internationally, and when I started as an agent, not every office phone even had long-distance dialing.
Cell phones couldn’t call long-distance either. We were still relying on snail mail to send documents and translations were slow to obtain. Now, we can instantly receive information in multiple languages and run it through translation tools. Technology has completely transformed operational efficiency.
On the other hand, the financial and technology sectors have evolved so quickly that it’s opened new avenues for criminal organizations to exploit. We’re talking about cryptocurrency and digital tokens that are being developed and launched every single day. That evolution has created a whole new world for criminals to move and store value—and that, I’d say, has been the biggest overall change: the technological evolution of what we understand as currency and value itself.
Q: Technology has certainly supercharged communications and partnerships, but its also opened novel hard-to-track digital corridors. In practice then, what does an illicit-finance investigation really look like today?
A: Investigations have a life of their own—that’s always how I approached them. Each one is its own little microcosm, because every investigation is built around the activities of unique human beings. That individuality creates its own rhythm—its own opportunities to generate criminal proceeds but also challenges for you as an investigator.
So, I think the number one rule is that there are no rules. This isn’t like learning how to dance; it’s not a simple one-two-three-four. Sometimes it’s four-one-two-three. Other times you start with three and finish with one. It really calls on you to be flexible—to be able to adapt to the organization—because ultimately, it’s the organization and its tactics that give you the cues for how you’re going to attack that particular challenge.
In that respect, there are never two investigations that are alike, which is awesome, because that means every single day is different. At least in my career, I never had that feeling of, “Okay, it’s time to get up and make the donuts.” I didn’t always make donuts. Sometimes I had to make French crullers, other times croissants, other times corn muffins. You just never knew.
You’d get up in the morning thinking you were going to do one thing, and sure enough—you weren’t. You were going to do something else. So, the kind of person who succeeds in this line of work is someone who’s flexible, who can roll with the punches, and who’s okay with not really knowing what’s going to happen tomorrow. You can have an idea, and occasionally, you’ll say, “Hey, tomorrow this is what’s going to happen,” and it actually does—but not often.
It isn’t a routine. There is absolutely no routine in law enforcement or investigations. There were plenty of times, depending on the type of work I was doing or the organization I was targeting, when I’d leave my house planning to have dinner or meet people—and I’d have to cancel because something came up. I’d find myself thousands of miles away, calling to say, “I’m sorry, this came up—I had to travel.”
I got to the point where I kept a suitcase in my car when I was working undercover, because I never knew when—or where—I’d have to go. That type of work, I found exciting. I found it fun, even though a lot of people wouldn’t. But if you want to be successful, if you don’t want to get frustrated, if you want to enjoy those 18-hour days—you have to enjoy what you’re doing.
Q: A lot of young or aspiring intel analysts, law enforcement officers, or agents that want to be in that type of role, don't think about the potential for undercover work. In these types of investigations, how you go from identifying a suspicious financial transaction to, “oh, I got to go undercover, I got to be a thousand miles away?”
A: Well, generally in enforcement, undercover work is something that people volunteer for. It’s also work that requires a certain level of experience—operational and psychological—before you’re even allowed to proceed.
Undercover work takes a toll on you, especially depending on the type of work you’re doing and how much time you actually spend undercover. Sometimes it’s something casual, where you meet a bad guy here and there and then you go home; other times it’s much more involved than that. But really, it all comes down to your ability and your team’s ability to infiltrate those organizations.
Usually, the way undercovers are introduced into situations is through a cooperating confidential informant within the organization. That informant will vouch for you, then you take over, and the informant sort of freezes themselves out. I mean, not as dramatic, obviously, but kind of like that Donnie Brasco-type scenario—the guy says, “Hey, he’s a friend of mine,” and now you’re in.
That’s typically how introductions happen. And then, whether or not it’s worth making that introduction really comes down to weighing: what are you after? What is your goal? How can you obtain that information?
Obviously, the primary reason to infiltrate an organization is to produce the best evidence. The best evidence in a criminal case is always going to come from the testimony of a government employee—a government agent. Because when a government agent testifies, they have a clean record, unlike a confidential informant, who probably became an informant because he wasn’t the best bad guy, right?
Most confidential informants are individuals with some kind of personal connection to criminal activity or the organization itself. Very few of them are people who just decide to do it, who have no criminal record, no tie to the activity, but somehow know everything that’s going on. That’s really not realistic.
So the primary purpose of introducing an undercover agent is to create that absolute best evidence—the testimony of a government agent against the defendant.
That’s really what goes into the equation: how can we get in? Do we have an “in”? And once we’re in, what are we looking for? Are we looking to move up a level within the organization? Are we trying to infiltrate to reach a bigger or more significant target? What exactly are we trying to achieve?
Most investigations don’t employ an undercover, but those that do almost always result in more significant outcomes.
Q: We’re getting into the tradecraft now—which is great. Outside the undercover side of things, a lot of the real work happens behind the scenes with data and analysis. What tools or approaches changed the game for you?
A: Tracking illicit finances and investigating these types of cases—whether it’s digital forensics, data analytics, or open-source work—it really depends on the investigation and the target. But I can tell you this: for financial investigations overall, the key has always been forensic accounting.
That’s something agencies have increasingly focused on and dedicated more resources to over the past few years. It always comes down to going over those accounts and finding how the funds are moving—because once you can see that movement, you can start identifying vulnerabilities.
So for financial investigations, forensic accountants and internal auditors are absolutely critical. They’re the most valuable people on an investigation because they ensure that everyone is working smarter and that time and resources are focused on uncovering all aspects of the organization that can disrupt or dismantle its operations.
Depending on the type of organization you’re investigating, open-source intelligence is also huge—especially as more criminal groups adopt these platforms for messaging and for achieving their own objectives. In many cases, OSINT is key not just for identifying criminal activity and initiating an investigation, but also for understanding how and where these actors operate.
It also helps corroborate information gathered from human sources and documentary evidence. Like everything else, there’s never a single “silver bullet” in an investigation—no single tool that suddenly makes the case. But the more access you have to these different types of information, the fewer gaps you’ll have in understanding how the organization operates.
That, in turn, makes for a much stronger case. It allows you to identify additional investigative avenues and prepare for multiple potential defenses, ultimately solidifying your evidence and your position.
Q: You mentioned earlier how critical those partnerships are between law enforcement and the private financial sector when it comes to identifying and disrupting illicit networks. Given the rise of new technologies and alternative financial platforms—cryptocurrency, digital transfers, and so on—how would you describe the state of cooperation between law enforcement, particularly HSI, and these institutions when you retired? Was that relationship improving?
A: It’s hit or miss. Some of these companies genuinely say, “Look, we just want to be part of the conversation.” They’ll go out of their way and be very deliberate about working together—asking, “What do you need? You have a question about how people are using our services? Come to me, I’ll explain how it works.”
That kind of information exchange is great, because we’re not in their business, and they’re not in ours. Often, you have these conversations with people who legitimately want to help. They’ll say, “I’m just a businessperson. I want to do the right thing. I’m not looking to do this for any reason other than to help build something that improves society.”
And many times after those conversations, they’ll realize, “Oh, yeah, we’ve been doing it wrong the whole time,” and make changes. It’s not always obvious to them because they don’t have the perspective, the experience, or the training that we have in identifying criminals or criminal activity in this space.
But by the same token, we often came out of those conversations thinking, “Oh, yeah, no—it’s impossible for them to do it that way,” because we were applying our own knowledge and law enforcement experience to their platform. Then we’d realize, “Wait, maybe there’s a different way to do it.”
That’s when true partnership happens. You reach that point where both sides are focused on closing vulnerabilities. The exact process of how you close them isn’t as important as making sure those vulnerabilities are actually addressed.
And that’s really where those relationships stand today—it’s been that way for a while.
Q: Earlier you mentioned the regulatory lag—the gap between what investigators need and how fast criminals adapt. From your perspective, what are the most critical gaps right now between regulation, investigative capability, and law enforcement policy?”
A: What criminal organizations do is use a lot of off-the-shelf products that were developed for legitimate business purposes—they just pump dirty money through them.
That’s the first point: criminal organizations don’t create these avenues. They exploit tried-and-true methods. There’s not a lot of research and development going into what they do—they alter, they adapt, and they exploit.
And that’s what makes the question hard to answer. These products and systems aren’t being created by criminals; they’re being built by the financial industry and marketed to legitimate, law-abiding customers.
So the real gap isn’t between laws, regulations, and law enforcement capabilities. The gap lies in assessing the risk of exploitation of a particular product when the financial industry puts it out.
That’s something I talk about a lot at anti-money-laundering conferences, and with friends in the financial sector. It’s one thing I’ve always advocated for. I’ll tell them, “I know this sounds like an incredible new financial product—it’s going to be profitable, customers will love it—but slow down a little. Take the time to figure out what it would take for a criminal organization to turn this against us, and against society.”
Now, when it comes to money laundering overall, there’s also a lack of willingness—both at the federal and state level—to actually prosecute these cases. If you look at federal money-laundering prosecutions each year, the number is usually under 1,200, compared to around 60,000 drug prosecutions annually. So those cases are few and far between.
There are also sentencing issues that make prosecution difficult. For example, if you’re running an illegal gambling operation, the federal penalty for gambling itself is up to five years, while money laundering carries a potential twenty-year sentence. But because the underlying or “specified unlawful activity” has a max of five years, you can launder money from your gambling operation and not face that twenty-year penalty. That’s a problem.
And broadly speaking, the biggest deficiency I see—and it’s not just in the U.S., it’s worldwide—is that anti-money-laundering regimes are still built for a cash economy in a world that’s rapidly moving toward electronic and even virtual currencies.
We still focus heavily on things like the $10,000 reporting limit for deposits or for traveling in and out of the U.S., and yes, there’s a growing push to raise those limits to “modernize” the system. That’s fine—we should modernize. But my argument is: if we’re going to do that, let’s move beyond just targeting cash. Let’s start targeting electronic funds transfers and virtual currencies. That’s how we actually build a truly modern system.
And again, this isn’t just an American issue—it’s a global one. But right now, it still feels like I’m shouting into the wind.
“It’s based on a pipe dream that says, ‘We’re going to destroy them.’ That ignores the biggest factor… drugs are fundamentally a demand problem.”
SA Tobon arrests Luis Hernando Gómez Bustamante, a Colombian drug trafficker for the Norte del Valle Cartel (NVC).
Q: As you’ve noted, prosecutions for money laundering remain surprisingly low, even when the evidence is there. Looking at the current administration’s approach to cartels and transnational criminal organizations, there still seems to be a focus on arrests and deportations rather than successful prosecutions. In your view, is that approach effective—or are we missing the reality that these cartels operate as businesses, not ideological movements?
No — it’s probably the least effective tactic that has ever been used to target cartels. By far. It isn’t based on fact or any coherent strategy. It’s based on a pipe dream that says, “We’re going to destroy them.” That ignores the biggest factor — and which I’ve seen as the Achilles’ heel of every policy in my thirty years: this one has more than an Achilles’ heel; it’s got an Achilles’ leg. It’s exposed.
More than a heel, it’s a huge weak spot, because it doesn’t consider that drugs are fundamentally a demand problem — and that side of the equation isn’t being addressed. If anything, funding for demand-reduction programs has gone from underfunded to basically unfunded. That’s the reality.
You can blow up all the go-fast boats you want, but unless you’re blowing up thousands of them every day, you’re only addressing a tiny fraction of the problem. And those people on the boats aren’t senior operators — they’re disposable. All you’re doing is putting additional people in danger without actually reducing the business.
In fact, I read recently that there’s too much cocaine in Europe: some organizations there are receiving and storing it because prices are so low. They’re holding product back so they can protect profit margins. This is a consumption issue. I wish I could say it’s because Europeans are using less, but they’re not — production has simply increased. Even though prices are falling, these organizations are still making plenty of money.
So, the core problem is you’re not attacking their customers. I’m not saying we should go after users with violence — that’s not what I mean — but if you counter increasing production with programs that reduce users, you create a substantial financial impact on these organizations.
All the tactics — seize everything, attack labs, extend operations overseas — have been tried and have failed because they weren’t paired with demand reduction. It’s not one or the other. People treat it as if you must either go after cartels or help addicts. That’s wrong. You have to do both. Only a combined effort that reduces supply and demand will cause those organizations to lose product and customers — and that’s what puts a business in real trouble.
“You can blow up all the go-fast boats you want, but unless you’re blowing up thousands of them every day, you’re only addressing a tiny fraction of the problem.”
SA Tobon arrests Colombian Cali Cartel leader Gilberto Rodriquez Orejuela.
Q: Recognizing that counterterrorism and counternarcotics aren’t zero-sum problems, if you were still Assistant Director at HSI and tasked with designing a national policy to counter cartel activity, what core elements would you prioritize?
I’d advocate for more help in reducing consumption while focusing enforcement on the finances—specifically the connection between the supply of dirty money that criminal organizations hold and the demand for U.S. dollars in the open market through international trade. One aspect of money laundering that gets almost no attention is foreign exchange.
These organizations sell narcotics, get paid in U.S. dollars, and those dollars become a commodity. The formal foreign-exchange market moves trillions of dollars every day worldwide, legally. But there are more than a hundred black-market foreign-exchange venues—clandestine markets, underground banks, parallel and gray markets—in places like China, Colombia, Nigeria, and Southeast Asia. They all have one thing in common: a supply of crime-derived money offered for sale to people who need those dollars, mostly for trade but also for travel and other purposes. That’s where I’d focus attention.
That doesn’t mean we shouldn’t interdict drugs. It’s about hitting criminal groups where it hurts—targeting their suppliers and customers, reducing the number of users, and cutting into their proceeds. The goal is to leave them short on goods, short on money, and short on customers. That’s where meaningful gains for law enforcement can come from, and frankly, we haven’t seen many of those in the fifty years since the war on drugs began.
When we talk about policy, though, the reality is that we’ve been trying versions of this for half a century. If the United States were to adopt the kind of strategy I’m proposing… is it even viable under our political system, where each administration needs quick wins? And if that weren’t a limitation, how long would real change take?
Is it viable? No—it’s a pipe dream. Every new administration wants to “try something different.” It’s like cooking a meal where every few minutes someone else takes over the stove—too much salt, not enough salt, heat too high, heat too low. Without consistency, you never get a complete dish. That lack of unity isn’t just an American problem; it’s global. Even in democratic systems, long-term continuity is rare. And in authoritarian ones, leaders often stay in power precisely because of their ties to criminal networks.
So, realistically, no—it’s not viable. In a perfect world, it would depend on unity and political will. The first thing the U.S. can control is demand. That means a national effort to prevent people from starting drug use and to provide sustained treatment for those already addicted.
That process takes years, maybe a decade or more. Addiction isn’t a six-month problem; it’s a chronic illness with relapses. That’s why people in recovery celebrate every clean day—it’s never one and done. There’s no “you’re cured” moment. Recovery requires consistent, long-term support and the political will to fund it continuously. That’s the part most leaders shy away from because it doesn’t deliver quick results.
If we can commit to sustained prevention, treatment, and financial disruption at the same time, that’s how we start reducing both users and production—and that’s the only way to seriously weaken these organizations’ business models.
Q: Well, I think we’ve solved enough of the world’s problems for one day. I’ll give you the final word—if you had a new law enforcement officer, intelligence analyst, or HSI agent sitting across from you, what would you want them to take away as they start their career?
I’d say humility—the humility to always know that no matter how much you learn, what you don’t know will always be so much bigger. Keep that mindset of being a lifelong learner.
That does a few things. First, it keeps your skills sharp. Second, it keeps you young, because you’re always looking at the world through the eyes of someone still discovering, still learning—and that’s a wonderful way to stay engaged. And third, it makes the days fly by. You blink, and suddenly it’s thirty years later.
You look around and think, I just got here. What am I doing? I still don’t know what I’m doing. Thirty years later, I’m still learning. And eventually, it’s like someone says, “Look, you don’t have to go home—but you can’t stay here.”